@wtfalch/foundry 0.38.0 → 0.39.0

package/dist/plan/signin-db-move.d.ts

@@ -0,0 +1,68 @@
+import type { ProjectSource, ServiceTarget, StepScope } from './own-services.js';
+import type { PlatformAuthDeps } from './platform-providers.js';
+/**
+ * Moves a company's sign-in data from its Coolify database to the TLS database (#746).
+ *
+ * 1. The new database app is created and healthy (`provisionSigninDb`): ZITADEL is still up.
+ * 2. ZITADEL is stopped, so nothing writes to the old database.
+ * 3. A one-shot job app on the same Docker network empties the new database, runs `pg_dump` from
+ *    the old internal URL into it, and compares the row count of every table in both. It reports
+ *    healthy only after that passes, which is the signal the step waits for.
+ * 4. The CA is mounted on ZITADEL, its DSN is switched, the move is recorded, and ZITADEL starts.
+ *
+ * The old database is never written to and never deleted. After any failure that follows the stop,
+ * the step reads ZITADEL's DSN back from Coolify and acts on what is really set: the old DSN starts
+ * ZITADEL on the old database (the new app and the job app stay for inspection; a rerun copies again),
+ * the new DSN records the move and starts ZITADEL on the new database. A DSN write that timed out
+ * without a verdict, or a DSN that cannot be read, leaves ZITADEL stopped and says so. The move is
+ * recorded before ZITADEL starts on the new database, never after, and a rerun that finds the new DSN
+ * set finishes the move instead of copying, so it never drops a database ZITADEL may have written to.
+ */
+export declare const SIGNIN_DB_MOVE_ENV: {
+    readonly oldUrl: "OLD_DATABASE_URL";
+    readonly newUrl: "NEW_DATABASE_URL";
+    readonly newAdminUrl: "NEW_ADMIN_DATABASE_URL";
+    readonly ca: "NEW_DATABASE_CA_B64";
+};
+/** Recorded id of the copy job app. */
+export declare const SIGNIN_DB_MOVE_APP_SCOPE_KEY = "signin_db_move_app";
+/**
+ * The job's script. Every line is plain shell; the Dockerfile carries it base64-encoded, so the SQL
+ * may hold quotes. It prints table counts and its own messages, never a URL.
+ */
+export declare function signinDbMoveScript(): string[];
+/** The copy job: the same pinned image as the database, so `pg_dump` matches the server's major version. */
+export declare function signinDbMoveDockerfile(): string;
+/** A URL the job connects to the new database with; the host name is checked against the certificate. */
+export declare function signinDbMoveNewUrl(host: string, password: string, database: string): string;
+export interface MoveRuntime {
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    onSecret?: (value: string) => void;
+    /** How long the copy job may run (default 30 minutes). */
+    signinDbMoveTimeoutMs?: number;
+    /** Pause between polls of the job (default 10 seconds). */
+    signinDbMovePollMs?: number;
+    /** How long ZITADEL may take to report stopped before the copy (default 2 minutes). */
+    signinDbStopTimeoutMs?: number;
+    /** How long ZITADEL may take to report healthy on the new database (default 5 minutes). */
+    readyTimeoutMs?: number;
+    /** How long the new database may take to report healthy (default 5 minutes). */
+    signinDbTimeoutMs?: number;
+}
+export interface MoveInput {
+    project: ProjectSource;
+    label: string;
+}
+/**
+ * The step. Returns without doing anything once the move is recorded. See the file comment for the
+ * order and for what a failure at each stage leaves behind.
+ */
+export declare function moveSigninDatabase(scope: StepScope, deps: Pick<PlatformAuthDeps, 'coolify' | 'heldKeys' | 'signinDbBackup'> & {
+    runtime?: MoveRuntime;
+    /** Reads the old database without the resource-limits patch the limited port adds: the old database is only read. */
+    readOldDatabase(uuid: string): Promise<{
+        internal_db_url?: string;
+        status?: string;
+    }>;
+}, target: ServiceTarget, input: MoveInput): Promise<void>;

package/dist/plan/signin-db-move.js

@@ -0,0 +1,338 @@
+import { pinnedRef } from '../bootstrap/versions.js';
+import { PLATFORM_AUTH_DB_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_SCOPE_KEY, findOrCreatePlatformApp, } from './platform-providers.js';
+import { SIGNIN_DB_TLS_SCOPE_KEY, SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY } from './signin-db-tls.js';
+import { SIGNIN_DB_NAME, SIGNIN_DB_PORT, SIGNIN_DB_USER, boundedCall, dockerfileAppCreator, ensureSigninDbCaFile, provisionSigninDb, waitHealthy, withCallTimeout, } from './signin-db.js';
+/**
+ * Moves a company's sign-in data from its Coolify database to the TLS database (#746).
+ *
+ * 1. The new database app is created and healthy (`provisionSigninDb`): ZITADEL is still up.
+ * 2. ZITADEL is stopped, so nothing writes to the old database.
+ * 3. A one-shot job app on the same Docker network empties the new database, runs `pg_dump` from
+ *    the old internal URL into it, and compares the row count of every table in both. It reports
+ *    healthy only after that passes, which is the signal the step waits for.
+ * 4. The CA is mounted on ZITADEL, its DSN is switched, the move is recorded, and ZITADEL starts.
+ *
+ * The old database is never written to and never deleted. After any failure that follows the stop,
+ * the step reads ZITADEL's DSN back from Coolify and acts on what is really set: the old DSN starts
+ * ZITADEL on the old database (the new app and the job app stay for inspection; a rerun copies again),
+ * the new DSN records the move and starts ZITADEL on the new database. A DSN write that timed out
+ * without a verdict, or a DSN that cannot be read, leaves ZITADEL stopped and says so. The move is
+ * recorded before ZITADEL starts on the new database, never after, and a rerun that finds the new DSN
+ * set finishes the move instead of copying, so it never drops a database ZITADEL may have written to.
+ */
+export const SIGNIN_DB_MOVE_ENV = {
+    oldUrl: 'OLD_DATABASE_URL',
+    newUrl: 'NEW_DATABASE_URL',
+    newAdminUrl: 'NEW_ADMIN_DATABASE_URL',
+    ca: 'NEW_DATABASE_CA_B64',
+};
+/** Where the job writes the CA it is given in env. */
+const JOB_CA_PATH = '/tmp/ca.crt';
+const JOB_DONE_FILE = '/tmp/done';
+/** Left by a run that did not finish: a restart of the same container then stops at once instead of copying again. */
+const JOB_FAILED_FILE = '/tmp/failed';
+const JOB_DUMP_FILE = '/tmp/dump.sql';
+/** Recorded id of the copy job app. */
+export const SIGNIN_DB_MOVE_APP_SCOPE_KEY = 'signin_db_move_app';
+/**
+ * The job's script. Every line is plain shell; the Dockerfile carries it base64-encoded, so the SQL
+ * may hold quotes. It prints table counts and its own messages, never a URL.
+ */
+export function signinDbMoveScript() {
+    const old = `"$${SIGNIN_DB_MOVE_ENV.oldUrl}"`;
+    const next = `"$${SIGNIN_DB_MOVE_ENV.newUrl}"`;
+    const admin = `"$${SIGNIN_DB_MOVE_ENV.newAdminUrl}"`;
+    const tables = "select quote_ident(schemaname) || '.' || quote_ident(tablename) from pg_tables where schemaname not in ('pg_catalog', 'information_schema') order by 1";
+    return [
+        '#!/bin/sh',
+        'set -eu',
+        // The dump holds the whole sign-in database: it is removed on every exit. A run that ends without
+        // `done` leaves `failed`, because Coolify restarts the container and a restart must not copy again.
+        `trap 'rm -f ${JOB_DUMP_FILE}; [ -f ${JOB_DONE_FILE} ] || touch ${JOB_FAILED_FILE}' EXIT`,
+        "trap 'exit 1' HUP INT TERM",
+        `[ ! -f ${JOB_FAILED_FILE} ] || exit 1`,
+        `rm -f ${JOB_DONE_FILE}`,
+        `printf %s "$${SIGNIN_DB_MOVE_ENV.ca}" | base64 -d > ${JOB_CA_PATH}`,
+        'fail() { echo "signin-db-move: $1"; exit 1; }',
+        `major=$(psql ${old} -Atc "show server_version_num" | cut -c1-2)`,
+        '[ "$major" = "16" ] || fail "the old database is not Postgres 16"',
+        `psql ${admin} -v ON_ERROR_STOP=1 -q -c "drop database if exists ${SIGNIN_DB_NAME} with (force)" -c "create database ${SIGNIN_DB_NAME}" || fail "the new database could not be emptied"`,
+        `pg_dump ${old} > ${JOB_DUMP_FILE} || fail "pg_dump failed"`,
+        `psql ${next} -v ON_ERROR_STOP=1 -q -f ${JOB_DUMP_FILE} > /dev/null || fail "the restore failed"`,
+        `rm -f ${JOB_DUMP_FILE}`,
+        `old_tables=$(psql ${old} -Atc "${tables}")`,
+        `new_tables=$(psql ${next} -Atc "${tables}")`,
+        '[ "$old_tables" = "$new_tables" ] || fail "the two databases hold different tables"',
+        'checked=0',
+        'for t in $old_tables; do',
+        `  a=$(psql ${old} -Atc "select count(*) from $t")`,
+        `  b=$(psql ${next} -Atc "select count(*) from $t")`,
+        '  [ "$a" = "$b" ] || fail "row count differs in $t: old $a, new $b"',
+        '  checked=$((checked + 1))',
+        'done',
+        '[ "$checked" -gt 0 ] || fail "the old database has no tables"',
+        'echo "signin-db-move: $checked tables copied, row counts equal"',
+        `touch ${JOB_DONE_FILE}`,
+        'exec sleep infinity',
+    ];
+}
+/** The copy job: the same pinned image as the database, so `pg_dump` matches the server's major version. */
+export function signinDbMoveDockerfile() {
+    const encoded = Buffer.from(`${signinDbMoveScript().join('\n')}\n`, 'utf8').toString('base64');
+    return [
+        `FROM postgres:${pinnedRef('postgres')}`,
+        `RUN echo '${encoded}' | base64 -d > /usr/local/bin/signin-db-move && chmod 0755 /usr/local/bin/signin-db-move`,
+        'ENTRYPOINT ["/usr/local/bin/signin-db-move"]',
+        `HEALTHCHECK --interval=10s --timeout=5s --start-period=10s --retries=1 CMD ["test", "-f", "${JOB_DONE_FILE}"]`,
+    ].join('\n');
+}
+/** A URL the job connects to the new database with; the host name is checked against the certificate. */
+export function signinDbMoveNewUrl(host, password, database) {
+    return `postgres://${SIGNIN_DB_USER}:${password}@${host}:${SIGNIN_DB_PORT}/${database}?sslmode=verify-full&sslrootcert=${JOB_CA_PATH}`;
+}
+/** A failure the step words itself. Anything else that goes wrong is reported without its cause, which could carry a URL. */
+class MoveFailure extends Error {
+}
+const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/** Polls of an `exited` job with no `running` seen before it counts as a stop (an `exited` read can be the container before the deploy). */
+const JOB_EXITED_POLLS = 6;
+/**
+ * Waits for the copy job to report healthy, which it does only after the counts match. The job never
+ * exits on success, so any exit is final: `restarting` at once, `exited` once the job was seen running
+ * or stayed exited for {@link JOB_EXITED_POLLS} polls. It has failed too at the deadline. A healthy
+ * status read before any other could be the container before the stop, so it counts only after a
+ * different status was seen.
+ */
+async function waitForJob(coolify, appId, runtime) {
+    const now = runtime.now ?? Date.now;
+    const sleep = runtime.sleep ?? defaultSleep;
+    const timeout = runtime.signinDbMoveTimeoutMs ?? 1_800_000;
+    const interval = runtime.signinDbMovePollMs ?? 10_000;
+    const deadline = now() + timeout;
+    let left = false;
+    let running = false;
+    let exitedPolls = 0;
+    for (;;) {
+        const { status } = await coolify.getApplication(appId);
+        if (status === 'running:healthy' && left)
+            return;
+        if (status !== 'running:healthy')
+            left = true;
+        if (status?.startsWith('running'))
+            running = true;
+        exitedPolls = status?.startsWith('exited') ? exitedPolls + 1 : 0;
+        if (status?.startsWith('restarting') ||
+            (status?.startsWith('exited') && (running || exitedPolls >= JOB_EXITED_POLLS))) {
+            throw new MoveFailure('the copy job stopped before the row counts matched');
+        }
+        if (now() >= deadline) {
+            throw new MoveFailure(`the copy job did not finish within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'})`);
+        }
+        await sleep(interval);
+    }
+}
+/** Coolify queues a stop. Waits until it reports the app stopped; `pg_dump` must not run while ZITADEL can still write. */
+async function waitStopped(coolify, appId, runtime) {
+    const now = runtime.now ?? Date.now;
+    const sleep = runtime.sleep ?? defaultSleep;
+    const timeout = runtime.signinDbStopTimeoutMs ?? 120_000;
+    const interval = runtime.signinDbMovePollMs ?? 10_000;
+    const deadline = now() + timeout;
+    for (;;) {
+        const { status } = await coolify.getApplication(appId);
+        if (status?.startsWith('exited') || status?.startsWith('stopped'))
+            return;
+        if (now() >= deadline) {
+            throw new MoveFailure(`ZITADEL did not report stopped within ${Math.round(timeout / 1000)}s (last status: ${status ?? 'unknown'}), so nothing was copied`);
+        }
+        await sleep(interval);
+    }
+}
+/** Runs `work`; a failure comes back as a note for the error message, never thrown. */
+async function attempt(work, failed) {
+    try {
+        await work();
+        return '';
+    }
+    catch (error) {
+        return error instanceof MoveFailure ? ` (${failed}: ${error.message})` : ` (${failed})`;
+    }
+}
+/**
+ * The step. Returns without doing anything once the move is recorded. See the file comment for the
+ * order and for what a failure at each stage leaves behind.
+ */
+export async function moveSigninDatabase(scope, deps, target, input) {
+    const coolify = withCallTimeout(deps.coolify);
+    const { label } = input;
+    const runtime = deps.runtime ?? {};
+    const recorded = scope.recordedIds();
+    if (recorded[SIGNIN_DB_TLS_SCOPE_KEY])
+        return;
+    const oldDbId = recorded[PLATFORM_AUTH_DB_SCOPE_KEY];
+    const zitadelId = recorded[PLATFORM_AUTH_ZITADEL_SCOPE_KEY];
+    if (!oldDbId || !zitadelId) {
+        throw new Error(`${label}: the sign-in database cannot be moved: the company's sign-in is not applied yet`);
+    }
+    const record = async (key, id) => {
+        scope.recordScopeId(key, id);
+        await scope.persist();
+    };
+    const old = await boundedCall(deps.readOldDatabase(oldDbId), 'Coolify getDatabase');
+    if (!old.internal_db_url || !old.status?.startsWith('running')) {
+        throw new Error(`${label}: the sign-in database cannot be moved: the old database is not running`);
+    }
+    runtime.onSecret?.(old.internal_db_url);
+    // The password alone too: a message that quotes only that part must be scrubbed as well.
+    if (URL.canParse(old.internal_db_url)) {
+        const password = decodeURIComponent(new URL(old.internal_db_url).password);
+        if (password)
+            runtime.onSecret?.(password);
+    }
+    const projectUuid = await input.project.ensure(coolify, scope);
+    const { environment } = await coolify.findOrCreateEnvironment(projectUuid, 'production');
+    const creator = (name, description) => dockerfileAppCreator(coolify, { projectUuid, environment, name, description });
+    // (b) The new database. ZITADEL is still up on the old one.
+    const db = await provisionSigninDb({
+        coolify,
+        keys: deps.heldKeys,
+        runtime,
+        name: target.names.signinDb,
+        internalHost: target.internal.signinDb,
+        volumeName: `${target.names.signinDb}-data`,
+        serverCertRef: target.refs.signinDbServer,
+        slug: target.id,
+        backup: deps.signinDbBackup,
+        backupBucket: target.names.signinBackupBucket,
+        recorded,
+        label,
+        environment,
+        record,
+        create: creator(target.names.signinDb, `${target.id}'s sign-in database with TLS (#746)`),
+    });
+    const newUrl = signinDbMoveNewUrl(target.internal.signinDb, db.password, SIGNIN_DB_NAME);
+    const adminUrl = signinDbMoveNewUrl(target.internal.signinDb, db.password, 'postgres');
+    runtime.onSecret?.(newUrl);
+    runtime.onSecret?.(adminUrl);
+    const dsnKey = 'ZITADEL_DATABASE_POSTGRES_DSN';
+    /** Which database ZITADEL's DSN names in Coolify right now. */
+    const liveDatabase = async () => {
+        try {
+            const dsn = (await coolify.listEnvs(zitadelId)).find((e) => e.key === dsnKey && !e.is_preview)?.value;
+            if (dsn === db.dsn)
+                return 'new';
+            return dsn === old.internal_db_url ? 'old' : 'unknown';
+        }
+        catch {
+            // The cause may carry a URL; the caller words the state.
+            return 'unknown';
+        }
+    };
+    /**
+     * ZITADEL's DSN names the new database. The move is recorded, with the flag that ZITADEL is not yet
+     * seen healthy there (it makes the planner plan the sign-in step), in one write before ZITADEL
+     * starts. Every failure says the exact state.
+     */
+    const startOnNew = async () => {
+        scope.recordScopeId(SIGNIN_DB_TLS_SCOPE_KEY, db.appId);
+        scope.recordScopeId(SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, '1');
+        try {
+            await scope.persist();
+        }
+        catch {
+            throw new MoveFailure('ZITADEL is stopped and its DSN names the new database; the move could not be recorded, so ZITADEL was not started on it; apply again, which records the move and starts it');
+        }
+        try {
+            await coolify.deploy(zitadelId);
+        }
+        catch {
+            throw new MoveFailure('the move is recorded and ZITADEL uses the new database, but it could not be started; start it in Coolify (the next apply starts it too)');
+        }
+        try {
+            await waitHealthy(coolify, zitadelId, { ...runtime, signinDbTimeoutMs: runtime.readyTimeoutMs ?? 300_000 }, label, 'ZITADEL');
+        }
+        catch (error) {
+            // waitHealthy words its own message (the app, the status); nothing else is repeated.
+            const why = error instanceof Error && error.message.includes('did not report healthy')
+                ? ''
+                : ' (a Coolify call failed)';
+            throw new MoveFailure(`ZITADEL did not report healthy on the new sign-in database${why}; the move is recorded, the old database is untouched, check ZITADEL's logs and apply again`);
+        }
+        await record(SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY, '');
+    };
+    // An earlier try that got as far as the DSN switch: ZITADEL may have written to the new database,
+    // so it is never emptied again. The move is finished instead.
+    const finished = (error) => {
+        throw new Error(`${label}: ${error instanceof MoveFailure ? error.message : 'the move could not be finished'}`);
+    };
+    const before = await liveDatabase();
+    if (before === 'new') {
+        await startOnNew().catch(finished);
+        return;
+    }
+    if (before === 'unknown') {
+        throw new Error(`${label}: the sign-in database cannot be moved: ZITADEL's DSN could not be read or names neither database, so nothing is copied; ZITADEL may still be stopped from an earlier attempt and this apply does not start it: read the DSN in Coolify, set it to one of the two databases, then apply again`);
+    }
+    let dsnWriteStarted = false;
+    let jobAppId;
+    try {
+        // (c) Nothing writes to the old database from here, once Coolify reports ZITADEL stopped.
+        await coolify.raw('POST', `/applications/${zitadelId}/stop`);
+        await waitStopped(coolify, zitadelId, runtime);
+        // (d) The copy job.
+        const job = await findOrCreatePlatformApp(coolify, target.names.signinDbMove, environment, () => creator(target.names.signinDbMove, `${target.id}'s sign-in database copy job (#746)`)(signinDbMoveDockerfile()));
+        jobAppId = job.appId;
+        await record(SIGNIN_DB_MOVE_APP_SCOPE_KEY, job.appId);
+        await coolify.updateApplication(job.appId, { health_check_enabled: false });
+        await coolify.bulkUpsertEnvs(job.appId, [
+            { key: SIGNIN_DB_MOVE_ENV.oldUrl, value: old.internal_db_url },
+            { key: SIGNIN_DB_MOVE_ENV.newUrl, value: newUrl },
+            { key: SIGNIN_DB_MOVE_ENV.newAdminUrl, value: adminUrl },
+            { key: SIGNIN_DB_MOVE_ENV.ca, value: Buffer.from(db.ca, 'utf8').toString('base64') },
+        ]);
+        // A job left running by a failed run would still read as healthy or as running.
+        if (job.running)
+            await coolify.raw('POST', `/applications/${job.appId}/stop`);
+        await coolify.deploy(job.appId, true);
+        await waitForJob(coolify, job.appId, runtime);
+        await coolify.raw('POST', `/applications/${job.appId}/stop`);
+        // (e) ZITADEL's side of the switch. The write may land even when the call does not answer.
+        await ensureSigninDbCaFile(coolify, zitadelId, db.ca, label);
+        dsnWriteStarted = true;
+        await coolify.bulkUpsertEnvs(zitadelId, [{ key: dsnKey, value: db.dsn }]);
+    }
+    catch (error) {
+        const reason = error instanceof MoveFailure
+            ? error.message
+            : 'a Coolify call failed (its message is not repeated)';
+        const timedOut = error instanceof Error && error.message.includes('did not answer within');
+        let state;
+        let tail = 'the old database is untouched and the new one is left for inspection';
+        const live = await liveDatabase();
+        if (live === 'new') {
+            tail = 'the old database is untouched';
+            try {
+                await startOnNew();
+                state = 'ZITADEL was started on the NEW database and reports healthy; the move is recorded';
+            }
+            catch (startError) {
+                state = `ZITADEL uses the NEW database, but ${startError instanceof MoveFailure ? startError.message : 'it could not be started'}`;
+            }
+        }
+        else if (live === 'old' && !(dsnWriteStarted && timedOut)) {
+            state = `ZITADEL was started again on the old database${await attempt(() => coolify.deploy(zitadelId), 'ZITADEL could not be restarted, start it by hand')}`;
+        }
+        else {
+            state =
+                live === 'old'
+                    ? 'ZITADEL is left stopped: its DSN still names the old database, but the write of the new one did not answer and may still land; do not start ZITADEL by hand, because writes on the old database would be lost if the new DSN lands later; wait until its DSN reads the same twice a minute apart in Coolify, then apply again'
+                    : 'ZITADEL is left stopped: its DSN could not be read or names neither database; do not start ZITADEL by hand; set its DSN to the old database in Coolify, then apply again';
+        }
+        const stoppedJob = jobAppId
+            ? await attempt(() => coolify.raw('POST', `/applications/${jobAppId}/stop`), 'the copy job could not be stopped')
+            : '';
+        throw new Error(`${label}: moving the sign-in database failed: ${reason}. ${state}${stoppedJob}; ${tail}`);
+    }
+    // Recorded before ZITADEL starts on the new database, so a rerun never copies over what it writes there.
+    await startOnNew().catch(finished);
+}

package/dist/plan/signin-db-tls.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The certificate authority and server certificate of a company's sign-in
+ * database (#746). One CA serves the whole platform and is created once; each
+ * company's database gets its own server certificate, signed by it, for the
+ * database's internal hostname. Both are held in `@wtfalch/keys` as one JSON
+ * value each (`{ cert, key }`), so a CA is never half written.
+ *
+ * Node has no certificate builder, so the DER is written here: ECDSA P-256,
+ * SHA-256, X.509 v3, only the extensions Postgres clients check.
+ */
+/** The platform's one CA, held as JSON `{ cert, key }` (PEM strings). */
+export declare const SIGNIN_DB_CA_REF = "signin-db:platform:ca";
+/** The recorded id of the server certificate's expiry (milliseconds since the epoch), so the planner can renew it. Not a secret. */
+export declare const SIGNIN_DB_CERT_NOT_AFTER_SCOPE_KEY = "signin_db_cert_not_after";
+/** Recorded id of the database app. */
+export declare const SIGNIN_DB_APP_SCOPE_KEY = "signin_db_app";
+/**
+ * Recorded once ZITADEL's DSN names the TLS database: from then on the sign-in step
+ * provisions this database and never the Coolify one.
+ */
+export declare const SIGNIN_DB_TLS_SCOPE_KEY = "signin_db_tls";
+/**
+ * Recorded while ZITADEL has been started on the TLS database and not yet seen healthy there: the
+ * planner then plans the sign-in step, which starts ZITADEL again and clears it (#746).
+ */
+export declare const SIGNIN_DB_ZITADEL_PENDING_SCOPE_KEY = "signin_db_zitadel_pending";
+/** A server certificate with less than this left is issued again. */
+export declare const SIGNIN_DB_CERT_RENEW_WINDOW_MS: number;
+export interface SigninDbKeys {
+    resolve(ref: string): Promise<string | null | undefined>;
+    put?(ref: string, value: string): Promise<void>;
+}
+export interface SigninDbTlsRuntime {
+    /** Called with every secret before it is stored or used, so no message or audit row can carry it. */
+    onSecret?: (value: string) => void;
+    now?: () => number;
+}
+export interface PemPair {
+    certPem: string;
+    keyPem: string;
+}
+export interface ServerCert extends PemPair {
+    /** Milliseconds since the epoch. */
+    notAfter: number;
+    /** True when this call made a new certificate. */
+    issued: boolean;
+}
+/**
+ * The platform's CA: the held one, else a new one stored under
+ * {@link SIGNIN_DB_CA_REF}. A held value that cannot be read, or whose
+ * certificate does not match its key, is an error and is never replaced: a
+ * company's database may already trust it. The value read back after a store
+ * is the one used, so two applies at once end with the same CA.
+ */
+export declare function ensureSigninDbCa(keys: SigninDbKeys, runtime?: SigninDbTlsRuntime, 
+/** A company already has a database or certificate made under the CA: a lost CA is then an error, never made again. */
+inUse?: boolean): Promise<PemPair>;
+/**
+ * The server certificate held under `ref` for `host`, issued again when it is
+ * missing, unreadable, for another host, signed by another CA, or has less
+ * than {@link SIGNIN_DB_CERT_RENEW_WINDOW_MS} left. The read-back after a
+ * store is the one used.
+ */
+export declare function ensureSigninDbServerCert(keys: SigninDbKeys, ca: PemPair, ref: string, host: string, runtime?: SigninDbTlsRuntime): Promise<ServerCert>;
+/**
+ * Whether the recorded server certificate expires within the renew window.
+ * Nothing recorded (a company not on the TLS database) is never due.
+ */
+export declare function signinDbCertDue(recordedIds: Readonly<Record<string, string>>, now: number): boolean;